Methods, systems, and devices for secure payment and providing multimedia at fuel dispensers

ABSTRACT

Methods, systems, and devices for secure payment and providing multimedia at fuel dispensers are provided. In general, a fuel dispenser can include a terminal configured to receive secure information and to show multimedia. The terminal can be configured to switch between a first mode and a second mode. The terminal can include a touchscreen. In the first mode, the touchscreen can have a shield enabled thereon that is configured to reduce a field of view of the touchscreen such that the touchscreen is only visible from specific angle(s). In the second mode, the shield can be disabled such that the touchscreen does not have a reduced field of view.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.16/600,040 filed on Oct. 11, 2019 entitled “METHODS, SYSTEMS, ANDDEVICES FOR SECURE PAYMENT AND PROVIDING MULTIMEDIA AT FUEL DISPENSERS,”which is a continuation of U.S. patent application Ser. No. 15/220,938(now U.S. Pat. No. 10,445,971) filed on Jul. 27, 2016 entitled “METHODS,SYSTEMS, AND DEVICES FOR SECURE PAYMENT AND PROVIDING MULTIMEDIA AT FUELDISPENSERS,” which are hereby incorporated by reference in theirentities.

FIELD

The present disclosure relates generally to methods, systems, anddevices for secure payment and providing multimedia at fuel dispensers.

BACKGROUND

The retail petroleum industry utilizes various types of paymentterminals for dispensing fuel to customers. In order to process customerpayments, payment terminals can request personally identifiableinformation (PII) from the customer. In addition to processing paymentfor dispensing fuel, payment terminals can provide additional functionssuch as playing multimedia including advertisements and sale offers orother promotions to customers. Thus, although a customer may not wantother people nearby to see the PII entered by the customer and certainsecurity requirements may be legally required to ensure secure input ofPII, the customer or the retailer may want to make the multimedia asvisible as possible to the customer or others around. While some paymentterminals use physical obstructions to protect the privacy of a customer(e.g., a hood over the payment terminal or the payment terminal beingtilted or recessed), these physical obstructions also block the view ofmultimedia provided via the payment terminal from certain angles (e.g.,the payment terminal can be at least partially obstructed when acustomer is standing at the gas tank at the rear of a car or when thecustomer is removing a nozzle from the fuel dispenser). It is thereforedifficult to provide the security needed for input of PII while alsoallowing for visibility of multimedia.

Accordingly, there remains a need for improved methods, systems, anddevices for secure payment and providing multimedia at fuel dispensers.

SUMMARY

In general, methods, systems, and devices for secure payment andproviding multimedia at fuel dispensers are provided.

In one aspect, an apparatus is provided that in one embodiment includesan electronic display configured to display content, a touchscreenoperably coupled to the electronic display and configured to receiveuser input in response to the content, and an active display shieldoperably coupled to the electronic display and configured to switchbetween a first mode and a second mode. The active display shieldobscures view of the content from a plurality of views in the firstmode, and the active display shield does not obscure view of the contentin the second mode.

The apparatus can vary in any number of ways. For example, the contentcan include a request for personally identifiable information (PII). Theelectronic display can also be configured to display multimedia, and theactive display shield can be configured to be in the second mode whenthe multimedia is displayed and to be in the first mode when the contentis displayed whether or not the multimedia is also displayed.

For another example, the active security shield can be positioned on topof the touchscreen, and the touchscreen can be positioned on top of theelectronic display.

For yet another example, the active security shield can be configured toautomatically switch between the first mode and the second mode inresponse to the user input. The user input can include secureinformation.

For still another example, the active security shield can be configuredto switch to the first mode from the second mode in response to thecontent requesting PII as at least a portion of the user input. Theactive security shield can be configured to switch to the second modefrom the first mode in response to the user input having been received.

For another example, the electronic display can be part of a fueldispenser.

In another aspect, a fuel dispenser is provided that in one embodimentincludes a memory storing instructions, and a processor operably coupledto the memory and configured to execute the instructions to display, viaa graphical user interface (GUI), a request for personally identifiableinformation (PII) that is restricted to viewing from a first field ofview of the GUI. The first field of view is less than an entire field ofview of the GUI. The processor is also configured to execute theinstructions to receive the PII via the GUI, and display, via the GUI,multimedia that is viewable from the entire field of view of the GUI.

The fuel dispenser can have any number of variations. For example, thePII can include one or more of a debit card personal identificationnumber (PIN), a credit card PIN, an email address, a zip code, a phonenumber, name of a person, address, social security number, driver'slicense number, handwriting, credit card number, debit card number, dateof birth, birthplace, login name, and password.

For another example, the GUI can be viewable from the entire field ofview prior to the request for PII being displayed. The processor can befurther configured to execute the instructions to automatically causethe GUI to switch from the GUI being viewable from the entire field ofview to the GUI being viewable from the first field of view in responseto the request for PII being displayed. The processor can be furtherconfigured to execute the instructions to automatically cause the GUI toswitch from the GUI being viewable from the first field of view to theGUI being viewable from the entire field of view in response to the PIIbeing received via the GUI.

For yet another example, the PII can be requested to process a paymentfor fuel, and the processor can be further configured to execute theinstructions to prevent the fuel from being dispensed from the fueldispenser until after the PII is received via the GUI.

In another aspect, a method is provided that in one embodiment includesdetermining that a prompt is to be displayed via a display of a device,determining whether the prompt is requesting input of secureinformation, determining whether an active security shield operablecoupled to the display is active, disabling the active security shieldin response to determining that the prompt is not requesting secureinformation and that the active security shield is active, and enablingthe active security shield in response to determining that the prompt isrequesting secure information and that the active security shield isinactive. The method also includes, after determining whether the activesecurity shield is active, displaying the prompt via the display. Themethod also includes receiving user input responsive to the displayedprompt.

The method can vary in any number of ways. For example, the device caninclude a fuel dispenser. For another example, determining that theprompt is to be displayed can include determining whether a touch inputto a touchscreen has been received. For yet another example, the secureinformation can include personally identifiable information (PII). Forstill another example, the active security shield can restrict a fieldof view of the display to less than an entire field of view of thedisplay.

Non-transitory computer program products (e.g., physically embodiedcomputer program products) are provided that store instructions, whichwhen executed by one or more data processors of one or more computingsystems, causes at least one data processor to perform operationsherein. Similarly, computer systems are also provided that may includeone or more data processors and memory coupled to the one or more dataprocessors. The memory may temporarily or permanently store instructionsthat cause at least one processor to perform one or more of theoperations described herein. In addition, methods can be implemented byone or more data processors either within a single computing system ordistributed among two or more computing systems. Such computing systemscan be connected and can exchange data and/or commands or otherinstructions or the like via one or more connections, including but notlimited to a connection over a network (e.g. the Internet, a wirelesswide area network, a local area network, a wide area network, a wirednetwork, or the like), via a direct connection between one or more ofthe multiple computing systems, etc.

BRIEF DESCRIPTION OF DRAWINGS

This invention will be more fully understood from the following detaileddescription taken in conjunction with the accompanying drawings, inwhich:

FIG. 1 is a schematic view of one embodiment of a fuel dispenser whichincludes a combined payment and multimedia terminal;

FIG. 2A is a schematic view of components of the terminal of FIG. 1;

FIG. 2B is a front-facing schematic view of the terminal of FIG. 1;

FIG. 2C is a schematic view of one embodiment of a customer verificationscreen;

FIG. 2D is a schematic view of one embodiment of a help screen;

FIG. 2E is a schematic view of one embodiment of a fueling screen;

FIG. 2F is a schematic view of one embodiment of an idle screen;

FIG. 2G is a schematic view of the idle screen of FIG. 2F viewed from adifferent angle;

FIG. 2H is a schematic view of the customer verification screen of FIG.2C viewed from a different angle with the information thereon obscuredfrom view;

FIG. 3 is a flowchart showing one embodiment of a method for securetouchscreen operation;

FIG. 4 is a schematic view of one embodiment of a system for processingcustomer payments and providing multimedia content to a terminal; and

FIG. 5 is a flowchart showing another embodiment of a method for securetouchscreen operation.

DETAILED DESCRIPTION

Certain exemplary embodiments will now be described to provide anoverall understanding of the principles of the structure, function,manufacture, and use of the systems, devices, and methods disclosedherein. One or more examples of these embodiments are illustrated in theaccompanying drawings. Those skilled in the art will understand that thesystems, devices, and methods specifically described herein andillustrated in the accompanying drawings are non-limiting exemplaryembodiments and that the scope of the present invention is definedsolely by the claims. The features illustrated or described inconnection with one exemplary embodiment may be combined with thefeatures of other embodiments. Such modifications and variations areintended to be included within the scope of the present invention.

Further, in the present disclosure, like-named components of theembodiments generally have similar features, and thus within aparticular embodiment each feature of each like-named component is notnecessarily fully elaborated upon. Additionally, to the extent thatlinear or circular dimensions are used in the description of thedisclosed systems, devices, and methods, such dimensions are notintended to limit the types of shapes that can be used in conjunctionwith such systems, devices, and methods. A person skilled in the artwill recognize that an equivalent to such linear and circular dimensionscan easily be determined for any geometric shape.

Methods, systems, and devices for secure payment and providingmultimedia at fuel dispensers are provided. In general, a fuel dispensercan include a terminal configured to receive secure information (e.g.,personally identifiable information (PII) that may potentially be usedto personally identify a person, a password to gain access to aninterior of the fuel dispenser or other device for maintenance and/ortesting purposes, etc.) and configured to show multimedia. The terminalcan be configured to switch between a first mode, in which the terminalhas a first level of security and is configured to accept input ofsecure information, and a second mode, in which the terminal has asecond level of security that is less secure than the first level ofsecurity and in which the terminal is configured to not accept input ofsecure information. Input of secure information may thus be securelyprotected since the secure information can only be input when theterminal is in the first mode, e.g., when the terminal is providing ahigher level of security. The terminal can include a touchscreenconfigured to receive touch input thereto. In the first mode, thetouchscreen can have a shield enabled thereon that is configured toreduce a field of view of the touchscreen such that the touchscreen isonly visible from specific angle(s), e.g., a straight-on angle fromwhich a customer using the touchscreen typically views the touchscreen.In the second mode, the shield can be disabled such that the touchscreendoes not have a reduced field of view. Thus, multimedia provided by theterminal when the terminal is in the second mode may be visible from anypoint within the field of view, thereby maximizing visibility of themultimedia, while still allowing secure information to be input to theterminal when needed by having the terminal be in the first mode forsuch input.

The methods, systems, and devices for secure payment and providingmultimedia described herein can be used at fuel dispensers or at anyother device including a terminal configured to receive secureinformation and to show multimedia. For example, a vending machine caninclude a terminal configured to switch between first and second modes.A customer currently making a purchase from the vending machine may thusbe able to securely input information to the terminal when the machine'sterminal is in the first mode without other people standing or sittingnear the machine being able to see the input, while multimedia on theterminal may be visible the customer and the other people when theterminal is in the second mode. For another example, a parking meter orother vehicle parking payment device can include a terminal configuredto switch between first and second modes. A customer currently payingfor parking at the device may thus be able to securely input informationto the terminal when the device's terminal is in the first mode withoutother people standing or sitting near the device being able to see theinput, while multimedia on the terminal may be visible the customer andthe other people when the terminal is in the second mode. For yetanother example, a taxi or other transportation service vehicle caninclude a terminal therein that is configured to switch between firstand second modes. A customer currently paying for transportation maythus be able to securely input information to the terminal when theterminal is in the first mode without other people sitting in thevehicle being able to see the input, while multimedia on the terminalmay be visible the customer and the other people when the terminal is inthe second mode.

FIG. 1 is a schematic view of a fuel dispenser 100 that includes apayment and multimedia terminal 110. As illustrated, the fuel dispenser100 includes four nozzles 105 configured to dispense fuel therefrom, butthe dispenser 100 can include more or less nozzles in other embodiments.Two of the nozzles 105 are on the other side of the dispenser 100,obscured from view in FIG. 1. The other side of the dispenser 100includes a second payment and multimedia terminal, also obscured fromview in FIG. 1, that is configured and used similar to the payment andmultimedia terminal 110. In other embodiments, the dispenser 100 caninclude another number of payment and multimedia terminals, such as asingle terminal, two terminals mounted side by side to increase anoverall display size, or a number of terminals equal to a number of thedispenser's nozzles. The fuel dispenser includes other componentsconfigured to facilitate payment for fuel and/or the dispensing of fuel,as will be appreciated by a person skilled in the art, such as acontroller configured to control the terminal 110, a memory configuredto store instructions executable by the controller, a communication unitconfigured to electronically communicate wired and/or wirelessly withdevices external to the fuel dispenser 100 (e.g., mobile phones, remoteservers, etc.), a pump configured to pump fuel from a fuel tank or otherreservoir, hoses in communication with the pump and respective ones ofthe nozzles, nozzle boots that seat the nozzles 105 therein, a fuelmeter configured to monitor fuel flow, valves, a vapor recovery system,etc.

In general, the terminal 110 is configured to receive secure information(e.g., PII, a password to gain access to an interior of the fueldispenser or other device for maintenance and/or testing purposes, etc.)and configured to show multimedia. The terminal 110 is also configuredto receive unsecure information, e.g., information that cannot be usedto personally identify the customer, such as a selection of fuel grade,a selection to print a coupon for use in a store at a site of the fueldispenser, a selection to display on the terminal 110 multimedia in theform of current weather information, etc. The terminal 110 can includevarious components to facilitate the input of information (secure andunsecure) thereto and the display of multimedia thereon, as discussedfurther below.

When a customer wishes to purchase fuel, the customer can utilize theterminal 110 to process the payment. In order to process payments, theterminal 110 can be configured to prompt the customer to providepersonal information thereto, such as any one or more of a PIN numberfor authorizing a debit card transaction, a zip code for authorizing acredit card transaction, and a phone number for accessing rewardsprograms. As this information may potentially be used to personallyidentify the customer, at least on some level, this information isgenerally referred to as personally identifiable information (PII).Other forms of PII that the terminal 110 can be configured to prompt forinput include name (or a portion thereof), address (or a portionthereof), email address, social security number (or a portion thereof,e.g., the last four digits), driver's license number, handwriting,credit card number, date of birth, birthplace, login name, password, orthe like. Because this PII is sensitive, customers typically wish toprevent others from viewing or obtaining what they are inputting intothe terminal 110 and/or government regulations applicable to thedispenser 100 may exist that require a certain level of security forinput of PII to an electronic system.

The terminal 110 can include a card interface for the insertion of acredit/debit card, which may be chip-enabled and/or may include amagnetic strip with encoded credit/debit card information. The terminal110 can include a physical display (e.g., a display screen) such as acathode ray tube (CRT), a liquid crystal display (LCD), or a lightemitting diode (LED) screen. In at least some embodiments, the terminal110 can include one or more speakers configured to output audiotherefrom, or the dispenser 100 can include the speaker(s) outside ofthe terminal 110.

The media (also referred to herein as “multimedia”) that can be shown onthe terminal 110 can include any one or more of various types of media.For example, the media can include advertisements for goods and/orservices. The fuel dispenser 100 may thus output advertising content(e.g., notices of goods/services, coupons, “flash” deals, etc.) to usersthereof, which may increase revenue for fueling site owners and/or othersellers. The goods can include any of a variety of types of goods, suchas durable goods (e.g., vehicle parts, toys, etc.), perishable goods(e.g., food, drink, etc.), and intangible goods (e.g., software, digitalmedia, etc.). The services can include any of a variety of types ofservices (e.g., oil changes, car washes, etc.). For another example, themedia can include entertainment content, such as television content andmusic content. The fuel dispenser 100 may thus output entertainment tousers thereof, which may improve user experience during fueling. For yetanother example, the media can include geographic content such as mapsand traffic conditions. The fuel dispenser 100 may thus outputinformation geographically relevant to users of the fuel dispenser 100.For still another example, the media can include weather content. Thefuel dispenser 100 may thus output information indicative of weatherconditions relevant to users of the fuel dispenser 100.

The form of the media can be visual only (e.g., a still image, a silentvideo, etc.), audible only (e.g., music, a spoken message, etc.), or acombination of visual and audible (e.g., a video with sound, narratedstill image, etc.). The media can be visually and/or audibly displayedand allow the user to access a coupon or other printable and/orelectronically savable promotion for later use by the customer. Forexample, displayed media can include a message indicating that a couponis available to a customer for a particular good or service that thecustomer may print for later use and/or access electronically for lateruse.

In at least some embodiments, the fuel dispenser 100 includes a medialibrary (e.g., has the media library on board) such that the fueldispenser 100 is configured to communicate directly with media source(s)and receive media content directly therefrom. The fuel dispenser 100 canthus be configured to be in control of its own media receipt schedule,to request media content from the media source(s) on demand, and toreceive media content specific to the fuel dispenser 100. The fueldispenser 100 can be originally manufactured to include the medialibrary, or an existing fuel dispenser 100 can be retrofit to includethe media library (e.g., can have the media library installed thereonand, if necessary, have a processor added thereto or have a currentprocessor upgraded to handle processing related to the media library).Embodiments of media libraries are further described in U.S. patentapplication Ser. No. 15/153,966 entitled “Management Of Fuel DispenserMedia” filed on May 13, 2016, which is hereby incorporated by referencein its entirety.

FIG. 2A illustrates components of the terminal 110 of FIG. 1. Asillustrated, the terminal 110 includes an active security shield 210, atouchscreen 220, and a physical display 230. The physical display 230 isconfigured to display information, display prompts for information,play/display media, and/or the like. The touchscreen 220, which islocated on top of the physical display 230, e.g., facing outwardtherefrom so as to face toward a user, is configured to receive userinput via detection of a physical touch of a surface of the touchscreen220. Various methods for detecting a physical touch may be used, as willbe appreciated by a person skilled in the art, such as capacitive,resistive, infrared (IR), optical, acoustic, or dispersive detectiontechnologies.

The active security shield 210 is located on top the touchscreen 220(and therefore on top of the physical display 230 as well). In otherembodiments, the active security shield 210 can be positioned betweenthe touchscreen 220 and the physical display 230 so as to be sandwichedtherebetween. The terminal 110 is configured to operate in a first oractive mode and a second or inactive mode each defined by the activesecurity shield 210. In the inactive mode, the active security shield210 allows for an unencumbered view of the physical display 230. Inother words, the active security shield 210 does not restrict a field ofview of the physical display 230 so as to not restrict a user's view ofcontent displayed by the physical display 230. For example, ifmultimedia content or other information is clearly visible on thephysical display 230 from zero to twenty feet away at angles betweenzero degrees (e.g., directly in front of the physical display 230) toseventy degrees on either side of the physical display 230, then theactive security shield 210 in the inactive mode would not obstruct themultimedia content or other information at any of these distances orangles.

In the active mode, the active security shield 210 is configured torestrict the field of view of the physical display 230 so as to obscurea user's viewing of the physical display 230 from certain angles and/orcertain distances. The field of view is not completely restricted in theactive mode, thereby allowing for some visualization of the display 230depending on a user's angle to and/or distance from the display 230. Forexample, using the example above, the active security shield 210 in theactive mode can be configured to only allow for viewing of informationon the physical display 230 from zero to three feet away and/or atangles between zero degrees to twenty degrees on either side. Thus, theactive mode may prevent or otherwise reduce the visibility of thephysical display 230 for anyone who is not the customer standing closeto the terminal 110. Doing so may decrease the potential that thecustomer's PII is obtained by another person (either directly by eye orindirectly through a camera or other monitoring device targeted to thedisplay 230), thereby increasing security and/or user confidence. Thespecific examples used herein are only for demonstration, as differentdistances, angles, and/or both distances and angles may be used torepresent the field of view in the active and/or inactive modes.

In general, the active security shield 210 includes a filter that, whenactive, restricts the field of view of the display 230 and that, wheninactive, does not restrict the field of view of the display 230 as ifthe shield 210 was not present in the system. In general, the filterincludes material configured to be electrically modified between a firststate (e.g., in the active mode), in which the filter restricts a fieldof view of the display 230 to which the filter is operably coupled, anda second state (e.g., in the inactive mode), in which the filter doesnot restrict the field of view of the display 230 to which the filter isoperably coupled. Examples of such material include liquid crystalmaterials such as twisted nematic material liquid crystal material,super twisted nematic liquid crystal material, and polymer dispersedliquid crystal material.

The filter is configured to be driven by a control signal from thesecure video module 240 that switches the filter on (e.g., in the activemode) and off (e.g., in the inactive mode). The secure video module 240is configured to transmit the control signal to the active securityshield 210 to turn the filter on (e.g., to electrically activate thematerial of the filter) in response to the secure video module 240determining that that filter is not already on (e.g., by checking acurrent power state of the filter as stored in a memory of the terminal110, by checking whether the most recent control signal previouslytransmitted to the filter was to turn the filter on or off, etc.) anddetermining that the display 230 is showing secure information thereon(e.g., by checking a library stored in a memory of the terminal 110indicating whether any information on the screen is flagged as beingsecure, by checking whether a security flag stored in a memory of theterminal 110 is on (e.g., is a “1” binary value indicating that at leastsome information on the screen is secure instead of a “0” binary valueindicating that no information on the screen is secure), etc.) or thatthe display 230 is showing a prompt to input secure information (e.g.,by checking a library stored in a memory of the terminal 110 indicatingwhether any prompt on the screen is flagged as requesting secureinformation, by checking whether a security flag stored in a memory ofthe terminal 110 is on, etc.). The secure video module 240 is configuredto transmit the control signal to the active security shield 210 to turnthe filter off (e.g., to electrically deactivate the material of thefilter) in response to the secure video module 240 determining that thefilter is not already off, that the display 230 is not showing secureinformation thereon, and that the display 230 is not showing a prompt toinput secure information. In at least some embodiments, the secure videomodule 240 can be configured to not determine a current power state ofthe filter (e.g., not determine whether the filter is currently on oroff) in determining whether or not to transmit a control signal to theactive security shield 210, which may help conserve processing resourcesand/or help ensure that the filter is in the desired on or off statesince a control signal will be sent (depending on the secure informationcheck) regardless of the filter's current state.

Embodiments of filters that can be used as the active security shield210 (and as active security shields in other embodiments of terminalsdescribed herein) are further described in U.S. Pat. No. 7,940,255entitled “Information Processing Device With Integrated Privacy Filter”issued on May 10, 2011, U.S. Patent Publication No. 2006/0044290entitled “Electronic Privacy Filter” filed on Aug. 24, 2004, and U.S.Patent Publication No. 2013/0300985 entitled “Integrated Privacy Filter”filed on May 14, 2012, which are hereby incorporated by reference intheir entireties.

As also shown in FIG. 2A, each of the active security shield 210, thetouchscreen 220, and the physical display 230 in electroniccommunication with a secure video module 240 via one or more connectionsthat can each be wired or wireless. The active security shield 210 iscoupled to the secure video module 240 via a first connection 215, thetouchscreen 220 is coupled to the secure video module 240 via a secondconnection 225, and the physical display 230 is coupled to the securevideo module 240 via a third connection 235. One or more of theconnections 215, 225, 235 can be implemented as a bus (e.g., a universalserial bus (USB)) connection, a low-voltage differential signaling(LVDS) connection, or the like). For example, the first and secondconnections 215, 225 can each be a USB connection, and the thirdconnection 235 is an LVDS connection.

The secure video module 240 is configured to control operation of one ormore of the active security shield 210, the touchscreen 220, and thephysical display 230 based upon a current state, user input, or otherinformation, as described herein. Based upon this control, the securevideo module 240 is configured to provide for operation of thetouchscreen 220 and/or an active privacy screen via the active securityshield 210 that allow for secure prompting/receiving on the terminal 110while also allowing for unencumbered media playback on the terminal 110.The secure video module 240 is illustrated as part of the terminal 110,but in other embodiments, the secure video module 240 can be includedelsewhere in the fuel dispenser 100.

Although illustrated separately, one or more of the components of theterminal 110 can be combined or integrated with other components of theterminal 110. For example, the touchscreen 220 and the physical display230 can be integrated to form a display screen with touchscreencapabilities. For another example, the active security shield 210 andthe touchscreen 220 can be integrated.

FIG. 2B illustrates a front-facing view of the terminal 110 of FIG. 1,e.g., a view facing a user of the terminal 110. In addition to oralternative to the use of the active security shield 210 describedherein, the terminal 110 can be configured to move input keys 270 alonga vertical axis 290 and/or a horizontal axis 280 of the surface of theterminal 110. Thus, while most keypads are fixed in position (eitherphysically or via software configuration), the terminal 110 may insteadplace a keypad in any of a number of different positions. For example,the input keys 270 are illustrated in a first configuration that is in acenter of the terminal 110. However, all of the input keys 270 may beshifted along the vertical axis 290 to create a second configuration.Similarly, all of the input keys 270 may be shifted along the horizontalaxis 280 to create a third configuration, or all of the input keys 270may be shifted along the vertical and horizontal axes 290, 280 to createa fourth configuration. The actual position/configuration of the inputkeys 270 may vary over time and/or may be randomized. Moving the inputkeys 270 may provide additional security, as the actual position of theinput keys 270 may be harder to predict, and recording devices (e.g., astill image camera, a video recording device, etc.) able to visuallyaccess the terminal 110 may be less likely to obtain PII. Although asimplified numeric touchscreen is illustrated, other combinations ofinput keys 270 can be utilized, such as a QWERTY keyboard foralphanumeric user input.

FIG. 2B illustrates the terminal 110 showing input keys 270 thereon towhich a user can provide input via touch. FIGS. 2C-2F illustrate otherembodiments of information that can be shown on the terminal 110. FIG.2C shows a customer verification screen requesting input of secureinformation thereto in the form of a PIN to verify the customer'sidentity. In addition to or instead of a PIN, the customer verificationscreen can request another type of verification, such an a patternentry, an answer to a “secret” question previously answered by thecustomer, biometric authentication (e.g., fingerprint verification, eyepattern verification, palm print verification, DNA verification, handgeometry verification, vein pattern verification, etc.), NFC tap, etc.The customer verification screen includes a hint at the customer'srecognized identification in the form of the customer's initials asidentified through a customer's swipe of a credit/debit card, althoughother hints are possible, such as a full or partial user ID, display ofan avatar image previously chosen by the customer, etc. If the PINentered is the customer can be given more than one opportunity to inputcorrect information before being refused.

FIG. 2D shows a help screen configured to be shown in response to auser's request for help, e.g., by the user touching a “help” button. Thehelp on the screen includes media in the form of a pre-recorded videomessage for demonstration of the feature for which the customerrequested help. The video message can dismiss automatically afterplaying and the terminal 110 can return to the screen from which thehelp was requested.

FIG. 2E shows a fueling screen configured to be shown during thedispensing of fuel from the dispenser 100. The fueling screen showsinformation related to the current fueling session while fuel is beingdispensed from the fuel dispenser 100 and shows media in the form ofcurrent traffic information for a geographic location including thedispenser 100, although other types of media can be additionally oralternatively displayed as discussed herein.

FIG. 2F shows an idle screen that can be a default view on the display230 shown when a fueling session is not active. The idle screen in thisillustrated embodiment shows media in the form of a promotional videoplaying on a loop to facilitate sales and/or the fueling facility orcompany providing the fuel dispenser 100. The display is dimmed to saveenergy. No audio plays to improve customer experience of customersadjacent to the fuel dispenser 100 but not actively using the fueldispenser 100, e.g., are using other fuel dispensers.

FIGS. 2C-2F show the various screens as viewed at a zero degree angle,e.g., directly in front of the display 230 showing the screens. Theinformation displayed on the various screens is visible at this zerodegree angle. FIG. 2G shows the idle screen of FIG. 2F as viewed from anon-zero angle. The information displayed on the idle screen is visibleand is thus not being obscured by the active security shield 210. Sincethe active security shield 210 is inactive, the information displayed onthe idle screen is visible from an entire field of view of the display230. The help screen of FIG. 2D and the fueling screen 2E of FIG. 2Ewould be similarly unobscured when viewed at this non-zero angle (andany other angle within the entire field of view) since they are notshowing or requesting input of secure information. FIG. 2H shows thecustomer verification screen of FIG. 2C viewed from the same non-zeroangle as in FIG. 2G. The information displayed on the customerverification screen is not visible and is being obscured by the activesecurity shield 210 since the customer verification screen is requestinginput of secure information. The non-zero angle of FIGS. 2G and 2H is anexample only, with the active security shield 210 also being able torestrict the field of view from other non-zero angles, such as fromevery non-zero angle such that the screen is only visible at the zeroangle or from every non-zero angle except those within a predeterminedthreshold of zero (e.g., within +/−one degree, +/−two degrees, etc.).

FIG. 3 illustrates one embodiment of a method 300 for secure touchscreenoperation. The method 300 is described with respect to the terminal 110of the dispenser 100 of FIG. 1, but the method 300 can be similarlyperformed using other embodiments of terminals and dispensers describedherein. Although specific components of the terminal 110 are illustratedas performing specific functions in a specific order, in otherembodiments the order of the functions may change, more or lessfunctions may be performed (e.g., credit card authorization, fueldispensing control, and/or the like), and/or different components mayperform or otherwise aid in the performance of the functions illustratedas being performed by other components. For example, all of theillustrated functions may be performed and/or controlled by the securevideo module 240 as opposed to being performed by various ones of thephysical display 230, the touchscreen 220, and the active securityshield 210, thereby allowing for more centralized control andcoordination of functions.

The method 300 starts at start block 305. The method 300 then proceedsto decision block 310, where the secure video module 240, for example,determines whether the terminal 110 is in an idle mode. The terminal 110being in the idle mode corresponds to a fueling session not being activeat the dispenser 100 for which the terminal 110 would be used, e.g.,involving fuel that may be or is being dispensed from either of the twonozzles 105 visible in FIG. 1. If the terminal 110 is not in the idlemode, then the method 300 proceeds to decision block 315 where thesecure video module 240, for example, determines whether a secure promptis needed. Determination of whether a secure prompt is needed can be inresponse to determining that PII is requested/needed from a user (e.g.,a customer at the fuel dispenser 100) and/or in response to receivingpayment information via a payment card reader (e.g., a user swipes theircredit/debit card). If a secure prompt is needed, then method 300proceeds to decision block 320 where the active security shield 210, forexample, determines whether the shield 210 is enabled. If not, then themethod 300 proceeds to operational block 325 where the active securityshield 210, for example, enables the shield 210 (e.g., the terminal 110enters the active mode from the inactive mode). Once the shield 210 isenabled at the operational block 325 or if the shield 210 was determinedto be enabled at the decision block 320, the method 300 proceeds tooperational block 330 where the physical display 230, for example,displays one or more prompts for the user to input information.

After displaying the prompts at the operational block 330, the method300 proceeds to operational block 335 where the touchscreen 220, forexample, captures input. The input can be in an y of a variety of forms,as discussed herein, such as one or more of a PIN number for authorizinga debit card transaction, a zip code for authorizing a credit cardtransaction, and a phone number for accessing rewards programs. Afterthe input is captured, the method 300 proceeds to operational block 340where the active security shield 210, for example, disables the activeshield 210 (e.g., the terminal 110 enters inactive mode from the activemode). After the active shield 210 is disabled, method 300 returns tothe decision block 310.

At the decision block 310, if the secure video module 240 determinesthat the terminal 110 is in the idle mode, then the method 300 proceedsto functional block 370 where the secure video module 240, for example,finds and decodes idle media 370. After the idle media is found/decoded,the method 300 proceeds to operational block 375 where the physicaldisplay 230, for example, may display media (e.g., shown idle screenthereon). After the idle media is displayed, the method 300 proceeds todecision block 380 where the touchscreen 220, for example, determineswhether the screen 220 was touched. If not, the method 300 returns tothe operational block 370 to find and decode new idle media (or theoperational block 375 to continue displaying the same idle media), suchthat media is continually displayed during the idle mode. The same idlemedia can be configured to be displayed for a predetermined amount oftime, e.g., one minute, five minutes, etc., before new idle media isfound and decoded, which may help keep the idle media fresh. If thetouchscreen 220 instead determines at the decision block 380 that thescreen 200 was touched, then the method 300 proceeds to the decisionblock 315.

At the decision block 315, if the secure video module 240 determinesthat a secure prompt is not needed, then the method 300 proceeds todecision block 345 where the active security shield 210, for example,determines whether the shield 210 is enabled. If the shield 210 isenabled, then method 300 proceeds to operational block 350 where theactive security shield 210, for example, disables the shield 210. Oncethe shield 210 is disabled at the operational block 350 or after theshield 210 is determined to not be enabled at the decision block 345,the method 300 proceeds to operational block 355. Similar to theoperational block 330, at the operational block 355 the physical display230, for example, displays a prompt, and the method 300 thereafterproceeds to operational block 360 where the touchscreen 220, forexample, captures input. Once the input is captured, the method 300returns to the decision block 310.

The method 300 may thus provide for a terminal 110 which allows forsecure input and unencumbered multimedia playback/display.

FIG. 4 illustrates one embodiment of a system for processing customerpayments and providing multimedia content to a terminal of a fueldispenser or other device. An apparatus consistent with the illustratedcomputing apparatus 400 can be used to implement a portion of the fueldispenser 100 and/or the terminal 110. Similarly, the computingapparatus 400 can be configured to perform the processes describedherein.

As illustrated, the computing apparatus 400 includes one or moreprocessors 410 configured to execute instructions that implementoperations consistent with those described herein. The apparatus 400includes a memory 420 configured to store executable instructions and/orinformation. The memory 420 can include solid-state memory, solid-statedisk drives, magnetic disk drives, or any other information storagedevice. The apparatus 400 can include a network interface 440 configuredto communicate with a wired network or a wireless network, such as thenetwork 460. Examples of wireless networks include WiFi, WiMax, andcellular networks (2G/3G/4G/5G). The computing apparatus 400 includesone or more user interface 450. The user interface 450 can includehardware or software interfaces, such as a keyboard, mouse, and/or otherinterface that can include a touchscreen integrated with a display 430.

The user interface 450 can include the touchscreen 220 of FIG. 2A, theprocessor 410 can include the secure video module 240 of FIG. 2A, andthe display 430 can include the physical display 230 of FIG. 2A. Theprocessor 410 can be configured to generate a graphical user interface(GUI) for the display 430. The GUI can be used to request and/or receivePII or other information from a user. The GUI can be viewable from afirst view that is substantially in front of the GUI, and the processor410 can be configured to cause the request to be obscured from aplurality of other views which are not substantially in front of the GUI(e.g., each of the plurality of other views being at an angle, distance,and/or combination of both from the front of the GUI that is greaterthan a threshold amount). In response to receiving the PII via the GUI,the processor 410 can be configured to cause multimedia content to bedisplayed on the display 430 that is viewable from the first view andthe plurality of other views. The processor 410 can be configured tocause display a request for PII in a plurality of different locations tobe shown on the GUI. Displaying the request for PII in the plurality ofdifferent locations can include displaying the request in a locationthat is vertically and/or horizontally offset from a center of the GUIor the display 430.

The computing apparatus 400 is configured to communicate with a backendserver 470 via the network 460. The backend server 470 can be configuredto access a database 480 configured to store information related to theuse of the fuel dispenser 100, information related to the use of theterminal 110, customer information, multimedia, and/or the like. In atleast some embodiments, the database 480 can be included as part of theserver 470. In at least some embodiments, instead of the apparatus 400controlling certain operation, the backend server 470 can instead beutilized to, e.g., authorize payment at the fuel dispenser 100, causemedia to be played/displayed at the terminal 110, and/or control or aidoperation of the terminal 110.

FIG. 5 illustrates another embodiment of a method 500 for securetouchscreen operation. The method 500 is described with respect to thesystem of FIG. 4, but the method 500 can be similarly performed usingother embodiments of systems described herein. Although specificoperations are illustrated as occurring in a specific order, in otherembodiments the order of the operations may change and/or more or lessoperations may be performed (e.g., credit card authorization, fueldispensing control, and/or the like).

In order to implement the method 500, the computing apparatus 400 caninclude an active display shield configured to obscure content shown onthe display 430 from a plurality of views which are not substantially infront of the display 430, and the processor 410 can be operably coupledto the active display shield. The method 500 starts at operational block510 where the processor 410 of the computing apparatus 400, for example,causes media to be displayed via the display 430 during an idle mode ofthe apparatus 400.

The method 500 proceeds to operational block 515 where the processor 410of the computing apparatus 400, for example, determines that a prompt isto be displayed via the electronic display 430 and cause exit from theidle mode. Determining that a prompt is to be displayed can includedetermining whether a user touch (e.g., via a touchscreen) or paymentinformation has been received.

The method 500 proceeds to operational block 520 where the processor 410of the computing apparatus 400, for example, determines whether theprompt is secure. Determining whether the prompt is secure can includedetermining whether the prompt requests PII. The method 500 thenproceeds to operational block 525 where the processor 410 of thecomputing apparatus 400, for example, determines whether the activedisplay shield is active (e.g., the terminal of the apparatus 400 is inan active mode).

The method 500 next proceeds to operational block 530 where theprocessor 410 of the computing apparatus 400, for example, causes theactive display shield to be disabled in response to determining that theprompt is not secure and that the active display shield is active.Additionally or alternatively to proceeding to the operational block530, the method 500 can proceed from the operational block 525 tooperational block 535 where the processor 410 of the computing apparatus400, for example, causes the active display shield to be enabled inresponse to determining that the prompt is secure and that the activedisplay shield is inactive.

From each of the operational blocks 530 or 335, the method 500 proceedsto operational block 540 where the processor 410 of the computingapparatus 400, for example, causes the prompt to be displayed via theelectronic display 430.

The method 500 then proceeds to operational block 545 where theprocessor 410 of the computing apparatus 400, for example, captures userinput responsive to the prompt. The method 500 thereafter proceeds tooperational block 550 where the processor 410 of the computing apparatus400, for example, causes the active shield to be disabled in response tocapturing the user input when the prompt is secure. After theoperational block 550, the method 500 returns to the operational block510.

The method 500 may therefore allow for a display which allows for secureinput and unencumbered multimedia playback, and/or may allow forincreased security due to the increased difficulty of obtaining PII froma customer at an apparatus such as the apparatus 400 or the fueldispenser 100.

One or more aspects or features of the subject matter described hereincan be realized in digital electronic circuitry, integrated circuitry,specially designed application specific integrated circuits (ASICs),field programmable gate arrays (FPGAs) computer hardware, firmware,software, and/or combinations thereof. These various aspects or featurescan include implementation in one or more computer programs that areexecutable and/or interpretable on a programmable system including atleast one programmable processor, which can be special or generalpurpose, coupled to receive data and instructions from, and to transmitdata and instructions to, a storage system, at least one input device,and at least one output device. The programmable system or computingsystem may include clients and servers. A client and server aregenerally remote from each other and typically interact through acommunication network. The relationship of client and server arises byvirtue of computer programs running on the respective computers andhaving a client-server relationship to each other.

These computer programs, which can also be referred to as programs,software, software applications, applications, components, or code,include machine instructions for a programmable processor, and can beimplemented in a high-level procedural language, an object-orientedprogramming language, a functional programming language, a logicalprogramming language, and/or in assembly/machine language. As usedherein, the term “machine-readable medium” refers to any computerprogram product, apparatus and/or device, such as for example magneticdiscs, optical disks, memory, and Programmable Logic Devices (PLDs),used to provide machine instructions and/or data to a programmableprocessor, including a machine-readable medium that receives machineinstructions as a machine-readable signal. The term “machine-readablesignal” refers to any signal used to provide machine instructions and/ordata to a programmable processor. The machine-readable medium can storesuch machine instructions non-transitorily, such as for example as woulda non-transient solid-state memory or a magnetic hard drive or anyequivalent storage medium. The machine-readable medium can alternativelyor additionally store such machine instructions in a transient manner,such as for example as would a processor cache or other random accessmemory associated with one or more physical processor cores.

To provide for interaction with a user, one or more aspects or featuresof the subject matter described herein can be implemented on a computerhaving a display device, such as for example a cathode ray tube (CRT) ora liquid crystal display (LCD) or a light emitting diode (LED) monitorfor displaying information to the user and a keyboard and a pointingdevice, such as for example a mouse or a trackball, by which the usermay provide input to the computer. Other kinds of devices can be used toprovide for interaction with a user as well. For example, feedbackprovided to the user can be any form of sensory feedback, such as forexample visual feedback, auditory feedback, or tactile feedback; andinput from the user may be received in any form, including, but notlimited to, acoustic, speech, or tactile input. Other possible inputdevices include, but are not limited to, touch screens or othertouch-sensitive devices such as single or multi-point resistive orcapacitive trackpads, voice recognition hardware and software, opticalscanners, optical pointers, digital image capture devices and associatedinterpretation software, and the like.

The media management described above is discussed with respect to mediamanagement for fuel dispensers, but, as mentioned above, media can besimilarly managed for other types of devices configured to output mediato customers or potential customers. For example, a media managementsystem for one or more taxis that include a media output device (e.g., adisplay screen in a back seat of the taxi, etc.) can include a medialibrary configured to provide the one or more taxis with new and updatedmedia content based on a unique identification of the taxi or a group oftaxis (e.g., a group of commonly-owned taxis, a group of taxis in a samegeographic area such as in a same city or in a same zip code, etc.).Riders of the taxi(s) may thus receive more timely and/or more relevantmedia content during their rides.

One skilled in the art will appreciate further features and advantagesof the invention based on the above-described embodiments. Accordingly,the invention is not to be limited by what has been particularly shownand described, except as indicated by the appended claims. Allpublications and references cited herein are expressly incorporatedherein by reference in their entirety.

1-20. (canceled)
 21. A method, comprising: displaying unsecureinformation on a terminal in a first mode in which a security shield ofthe terminal is inactive; after displaying the unsecure information inthe first mode, displaying on the terminal a request for input of secureinformation to identify a customer; wherein the terminal displays therequest in a second mode in which the security shield is active andobscures a view of the request; and wherein the terminal automaticallymoves from the first mode to second mode in response to the requestbeing displayed.
 22. The method of claim 21, wherein the secureinformation includes a personal identification number (PIN).
 23. Themethod of claim 21, wherein the secure information includes afingerprint.
 24. The method of claim 21, wherein the secure informationincludes a biometric input including at least one of an eye pattern, apalm print, DNA, hand geometry, and a vein pattern.
 25. The method ofclaim 21, wherein the security shield includes a filter; and moving fromthe first mode to the second mode comprises electrically modifying amaterial of the filter.
 26. The method of claim 21, further comprisingreceiving the input of secure information; wherein the terminalautomatically moves from the second mode to first mode in response tothe receipt of the input of secure information.
 27. The method of claim21, wherein, in the second mode, the security shield obscures the viewof the request from a plurality of angles; and in the first mode, thesecurity shield does not obscure a view of the unsecure information fromany of the plurality of angles.
 28. The method of claim 21, wherein, inthe second mode, the security shield obscures the view of the requestfrom a distance that is greater than a predetermined distance; and inthe first mode, the security shield does not obscure a view of theunsecure information from the distance that is greater than thepredetermined distance.
 29. The method of claim 21, wherein the terminalincludes one of a fuel dispenser, a vending machine, a parking paymentdevice, and a transportation service vehicle.
 30. The method of claim29, wherein a processor of the terminal causes the terminal to displaythe unsecure information, causes the terminal to display the request,and causes the automatic movement; the unsecure information is shown ona display screen of the terminal; and the request is shown on thedisplay screen of the terminal.
 31. A device, comprising: a terminalconfigured to receive input of secure information and to displaymultimedia, the terminal comprising a screen configured to show arequest for input of the secure information to identify a customer andconfigured to show the multimedia, a security shield operatively coupledto the screen, and a processor configured to automatically move theterminal from a first mode, in which the security shield is inactive, toa second mode, in which the security shield is active and obscures aview of the request, in response to the request being shown on thescreen; wherein the multimedia is shown with the terminal in the firstmode, and the request is shown with the terminal in the second mode. 32.The device of claim 31, wherein the secure information includes at leastone of a personal identification number (PIN) and a fingerprint.
 33. Thedevice of claim 31, wherein the secure information includes a biometricinput including at least one of an eye pattern, a palm print, DNA, handgeometry, and a vein pattern.
 34. The device of claim 31, wherein thesecurity shield includes a filter; and moving from the first mode to thesecond mode comprises electrically modifying a material of the filter.35. The device of claim 31, wherein the processor is configured to causethe terminal to automatically move from the second mode to first mode inresponse to the receipt of the input of secure information.
 36. Thedevice of claim 31, wherein the terminal includes one of a fueldispenser, a vending machine, a parking payment device, and atransportation service vehicle.
 37. A device, comprising: a terminalconfigured to display multimedia and to receive input of secureinformation to identify a customer, the terminal comprising a securityshield, and a screen operatively coupled to the security shield,configured to show a request for input of the secure information withthe security shield in a first state in which the security shieldobscures a view of the request, and configured to show the multimediawith the security shield in a second state in which the security shieldis not obscuring a view of the multimedia; wherein the terminal includesone of a fuel dispenser, a vending machine, a parking payment device,and a transportation service vehicle.
 38. The device of claim 37,wherein the security shield is configured to move between the firststate and the second state by electrically modifying a material of thesecurity shield.
 39. The device of claim 37, wherein the security shieldobscures the view of the request for a first user a beyond apredetermined distance away from the screen while allowing a second userless than the predetermined distance away from the screen to view therequest.
 40. The device of claim 37, wherein the security shieldobscures the view of the request for a first user viewing the screenfrom any angle within a first range of angles while allowing a seconduser to view the request from any angle within a second, different rangeof angles.
 41. The device of claim 37, wherein the secure informationincludes at least one of a personal identification number (PIN) and afingerprint.
 42. The device of claim 37, wherein the secure informationincludes a biometric input including at least one of an eye pattern, apalm print, DNA, hand geometry, and a vein pattern.